emotet | d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2

General

Target

d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe
Size

104KB
MD5

3ca75e816ed0e2a8417b6d5533b4c9fa
SHA1

95aa335d01acc03b74ccca3f08d4f0b3781c2c3e
SHA256

d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2
SHA512

84bf1a92fbe40f2313477b0d990e654863026d9e36bbe4f9971f91cdb1b4b38a0abb3f8be242591be861d63a5b1ab0e0dc3b967956d28d32758c4c4458b32796
SSDEEP

1536:99XM2K4Y3kK5MNq5cktsVPkRcT5nEYJyuXtg/I/rSLfrsQAPHRPmK4jrz3nYxY:998xkK5h5xwPDTZrJ/rqzAsjrz3nYxY

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

soundflow.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	soundflow.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

soundflow.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	soundflow.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}\WpadDecisionTime = d09157156e06d901	soundflow.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}\16-85-18-41-54-1a	soundflow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-85-18-41-54-1a\WpadDecisionReason = "1"	soundflow.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-85-18-41-54-1a\WpadDecisionTime = d09157156e06d901	soundflow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}\WpadDecision = "0"	soundflow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-85-18-41-54-1a\WpadDecision = "0"	soundflow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	soundflow.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	soundflow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	soundflow.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	soundflow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}\WpadDecisionReason = "1"	soundflow.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	soundflow.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}	soundflow.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-85-18-41-54-1a	soundflow.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}\WpadNetworkName = "Network 2"	soundflow.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	soundflow.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	soundflow.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	soundflow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	soundflow.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	soundflow.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

soundflow.exe

pid process

1676 soundflow.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe

pid process

108 d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe

pid	process
1676	soundflow.exe

pid	process
108	d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exed88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exesoundflow.exesoundflow.exe

pid	process
580	d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe
108	d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe
1420	soundflow.exe
1676	soundflow.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exesoundflow.exe

description	pid	process	target process
PID 580 wrote to memory of 108	580	d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe	d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe
PID 580 wrote to memory of 108	580	d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe	d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe
PID 580 wrote to memory of 108	580	d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe	d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe
PID 580 wrote to memory of 108	580	d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe	d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe
PID 1420 wrote to memory of 1676	1420	soundflow.exe	soundflow.exe
PID 1420 wrote to memory of 1676	1420	soundflow.exe	soundflow.exe
PID 1420 wrote to memory of 1676	1420	soundflow.exe	soundflow.exe
PID 1420 wrote to memory of 1676	1420	soundflow.exe	soundflow.exe

C:\Users\Admin\AppData\Local\Temp\d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe
"C:\Users\Admin\AppData\Local\Temp\d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:580

C:\Users\Admin\AppData\Local\Temp\d88767640afcf2207b483e70115cd64cd1ddf156106af0961ec537509de705e2.exe
--af1e0f35
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:108

C:\Windows\SysWOW64\soundflow.exe
"C:\Windows\SysWOW64\soundflow.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\soundflow.exe
--4ca8adb3
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-55-0x0000000000000000-mapping.dmp

Download
memory/108-59-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/108-60-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/108-61-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/108-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/580-54-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/580-56-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/580-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1676-63-0x0000000000000000-mapping.dmp

Download
memory/1676-66-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1676-67-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads